On Fri, May 27, 2011 at 12:15:28AM +0200, Thomas Weber wrote:
> Hmm nobody cares?
I care, but not sure what to say here.
I am no expert in linux-vserver network handling, but I have quite some
experience with shared physical network and different networks on top
regarding iptables-code. The short statement is: avoid it. All sorts of
things fail as the kernel sees things and takes conclusions on these.
One thing is 'Proxy ARP', if this is enabled, your host will answer for
all hosts on one interface it has a route to on some other interface.
Given a client has a bad netmask you can basically communicate with all
the hosts on the other nets without a routing table.
Then there is the ip_spoofing protection, it drops packages which are
thought to be on the wrong interface, you might be able to see them by
enabling 'log_martians'.
If you habe 2 interfaces on the same physical lan, one feels free to
answer for IPs the other has, 'arp_filter' can fix this for you.
In your previous post you stated 2 network interfaces, both of them
having a default route. According to my experience this won't route a
single packet via the other default route. If you want to make one
host route via one default gateway and the other via the other one, you
need to use multiple routing tables and set 'ip rule' stuff in suitable
way.
If 2 VServers on your host communicate with each other, no routing table
is involved at all. No alternate routing table will get you out of this.
None of these thinsg seem to be directly valid for your case, maybe they
help in finden the real solution, though.
Regards,
Adrian
-- LiHAS - Adrian Reyer - Hessenwiesenstraße 10 - D-70565 Stuttgart Fon: +49 (7 11) 78 28 50 90 - Fax: +49 (7 11) 78 28 50 91 Mail: lihas_at_lihas.de - Web: http://lihas.de Linux, Netzwerke, Consulting & Support - USt-ID: DE 227 816 626 StuttgartReceived on Fri May 27 15:47:43 2011